US sanctions Russian exploit broker for trading stolen offensive tools

The US Department of the Treasury has sanctioned Operation Zero, a Russia-based exploit brokerage network, along with its founder Sergey Sergeyevich Zelenyuk, for acquiring and selling stolen US cyber capabilities. The action was taken under the Protecting American Intellectual Property Act, the first time the legislation has been used against the theft and trade of sensitive digital tools. According to Treasury, the network purchased and brokered proprietary exploit components developed for US government use, paying millions of dollars in cryptocurrency, and facilitated sales of zero-day exploits to foreign intelligence services and criminal actors. The sanctions block property under US jurisdiction and prohibit US persons from transacting with the designated parties.

What this means for your organisation

The case says something about the market organisations are defending against. Offensive capability is a commodity that gets resold, and what an intelligence service uses today can be pointed at an ordinary business by criminals shortly after. For Norwegian companies with US ownership, US customers or dollar payment flows, it is also a reminder that sanctions screening has to be run in practice, not only described in policy.

Berigo recommends

• Assume zero-day exploits will reach criminal hands, and give detection and recovery the same priority as prevention.
• Verify that sanctions screening is actually run against new suppliers and counterparties rather than merely documented.
• Include exposure to security tooling vendors in risk assessment on the same terms as other supplier risk.
• Help the board understand that the threat picture is moved by market forces, not only by technology.

Source

• home.treasury.gov